---
title: "Add an industry pack to your app"
description: "Turn on the payments, healthcare, insurance, finance or education pack, see what it adds, and check the controls it makes checkable."
section: "guides"
status: "Planned for 1.2"
spec: "industry-packs"
canonical: "https://mainsdk.dev/docs/guides/use-industry-packs"
updated: "2026-10-28"
---

# Add an industry pack to your app

> Turn on the payments, healthcare, insurance, finance or education pack, see what it adds, and check the controls it makes checkable.

Status: Planned for 1.2 · Canonical: https://mainsdk.dev/docs/guides/use-industry-packs · Updated: 2026-10-28

You will switch on a pack, read what it adds, and run its controls. It takes about 15 minutes. A pack makes controls checkable; it is not a certification.

## You need

- A MainSDK app with a `main.yaml`.

## 1. Name the pack

```yaml title="main.yaml"
industry: payments
```

Packs are signed bundles delivered through `delivery.packs`; run `npx mainsdk sync` to fetch them. Without delivery, a `packs/payments/` folder in the project is read instead. A pack can only tighten the baseline: it adds forbid policies, refusals and requirements, never a permission.

## 2. See what it adds

`npx mainsdk explain config` lists each policy, label rule, allowed driver and control the pack adds, with `packs/payments@1.0.0` as its source.

## 3. Check and assure

`npx mainsdk check` reports each broken rule with the control it maps to, such as PCI DSS 4.0.1 requirement 3.2.1 for a field labelled `pan`, with the fix "use hosted fields". For PCI DSS 6.4.3 and 11.6.1, list your payment pages and approved scripts:

```yaml title="main.yaml"
compliance:
  pages: [checkout.html]
  scripts:
    - { host: js.stripe.com, reason: Hosted fields, owner: payments }
```

`npx mainsdk assure --standard pci-dss-4.0.1` fails 6.4.3 with the host of any script not on the list, and raises an 11.6.1 alert when a payment page changes from its recorded hash. `--accept-pages` records the current pages as the new baseline.

## 4. Write your own

A pack is a folder of `pack.yaml`, `labels.yaml`, `evidence.yaml` and `policies/*.cedar`. `npx mainsdk pack build packs/mine --out mine.json` checks that it only tightens, uses canonical labels and maps each control to a pinned standard version and an SCF control, then writes the bundle.

## Check it worked

Run `npx mainsdk check --json` and find the `pack` gate. Every pack also adds the sentence "This pack makes controls checkable; it is not a certification." to the launch report.